Hi,
I have a serious problem. I'm trying to get the counts of all the values for a field in a comma delimited list, but seems Splunk only picks up the first value, so I cannot use stats count by Fieldname to show it directly.
Part of the search is this:
&fieldA=a,b,c,d&fieldB=a,b,c,d HTTP/1.1" 200
How do I get all the counts for a, b, c, d and output the count in a table?
For example:
Field A
a 20
b 22
c 23
d 24
Please suggest a search, thanks.
Try like this (assuming the field names are fixed, e.g. fieldA fieldB etc.)
your base search | rex field=_raw "fieldA=(?<fieldA>[^&\s]+)" | makemv fieldA delim="," | stats count by fieldA
Try like this (assuming the field names are fixed, e.g. fieldA fieldB etc.)
your base search | rex field=_raw "fieldA=(?<fieldA>[^&\s]+)" | makemv fieldA delim="," | stats count by fieldA
thank you! it seems to work